BIP39 vs PBKDF2 vs Scrypt vs Argon2

A KDF is the tool that turns a human-typeable password into a cryptographic key. The two mandatory properties: it must be deterministic (same password → same key) and it must be slow enough that an attacker cannot try billions of guesses per second. Different KDFs achieve "slow" in different ways, and those differences directly determine recovery feasibility.

The four major KDF families

PBKDF2 (2000)

Password-Based Key Derivation Function 2 from RSA Labs. Conceptually trivial: HMAC the password+salt N times. Slowness comes purely from CPU iterations. Crucially, PBKDF2 has no memory cost — a GPU can run thousands of instances in parallel using only registers and L1 cache. This is why PBKDF2-protected wallets fall so quickly.

Bcrypt (1999)

Designed for password hashing in Unix systems. Uses a modified Blowfish cipher with adjustable cost. Modest memory footprint (4 KB). Mostly uncommon in crypto wallets because it lacks key-stretching to arbitrary lengths.

Scrypt (2009)

Designed by Colin Percival explicitly to thwart custom hardware attacks. Uses a configurable amount of memory (parameter N controls memory and time). At N=262144, r=8, p=1 each candidate requires 256 MB. A consumer GPU has 8-24 GB total — so it can only run 30-90 parallel scrypt instances, not millions. Hence the 50 H/s number for high-cost MEW.

Argon2 (2015)

Winner of the Password Hashing Competition. Three variants: Argon2d (data-dependent, stronger vs GPU), Argon2i (data-independent, side-channel resistant), Argon2id (hybrid, modern default). Strictly better than scrypt by current standards but slow adoption in crypto wallets.

Side-by-side throughput on RTX 4090

Why BIP39 uses such weak parameters

BIP39 specifies seed = PBKDF2-HMAC-SHA512(mnemonic, "mnemonic" + passphrase, 2048 iterations, 64 bytes). 2048 iterations is laughably low by general standards. The reason is intentional:

# BIP39 entropy budget
12 words = 11 bits/word x 12 = 132 bits (128 entropy + 4 checksum)
24 words = 11 bits/word x 24 = 264 bits (256 entropy + 8 checksum)

# A 12-word mnemonic has 128 bits of entropy.
# 2^128 = 3.4e38 candidates - already infeasible to brute-force
# regardless of KDF speed.

# The KDF protects the OPTIONAL passphrase, not the mnemonic.
# Since most users have no passphrase, low iterations are fine.
# Users WITH a passphrase have their security in the passphrase
# strength, not the iteration count.

This design choice is also why Trezor / Ledger passphrase brute-force is feasible — see our Trezor passphrase guide.

Memory hardness — the killer feature

A consumer GPU has 16-24 GB of VRAM. With PBKDF2 (1 KB per candidate), it can run 16 million parallel candidates. With scrypt N=262144 (256 MB per candidate), it can run only 64-96. The 250,000x reduction in parallelism is precisely the protection scrypt offers.

ASIC-level analysis: a custom chip optimized for SHA-256 can do PBKDF2 attacks at terahash-per-second speeds. A custom chip for scrypt is bottlenecked by memory bandwidth — and modern DRAM costs are not falling fast. This is why Litecoin (scrypt PoW) resisted ASICs for years.

Per-wallet KDF audit

What "uncrackable" actually means

A password is practically uncrackable when its entropy times the KDF cost exceeds the global compute budget. Concretely:

# Bitcoin network does ~6e20 SHA-256 ops/sec (April 2026)
# Re-purposed to crack PBKDF2-SHA256 10K iter MetaMask:
#   60 quintillion / 10K = 6e16 H/s effective
# A 14-char fully-random password has ~95 bits = 4e28 candidates
# Total time = 4e28 / 6e16 = 7e11 seconds = 22000 years

# So even with the entire Bitcoin network for one purpose,
# a 14-char random MetaMask password is uncrackable.

# But: a 6-char "password" + 2 digits (rockyou-style) is in the
# top 10000 most common patterns. Any GPU finds it in milliseconds.

Related guides

• Password entropy explainer.
• MEW scrypt deep dive.
• MetaMask PBKDF2 attack.
• Trezor passphrase math.

Frequently asked questions